AI-Based Ensemble Learning Framework For Cyber Threat Detection And Response

Abstract

The rapid digitization of critical services in India has significantly expanded the cyber-attack surface, rendering traditional security mechanisms inadequate against sophisticated modern threats. This paper presents a comprehensive AI-Based Ensemble Learning Framework for cyber threat detection and response, specifically designed to address the unique challenges of the Indian cybersecurity ecosystem. The framework integrates four complementary models—Random Forest, XGBoost, Deep Neural Networks (DNN), and Long Short-Term Memory (LSTM) networks—through a stacking ensemble approach with Logistic Regression as the meta-learner [27], [28], [30], [31]. Evaluation across four standard benchmark datasets—CIC-IDS2017, UNSW-NB15, NSL-KDD, and ICSCASD-MPLC—demonstrates detection accuracy ranging from 93% to 98% with false positive rates as low as 1.6% [23]-[26]. The system achieves near real-time performance with an average detection latency of 112 ms, substantially improving upon traditional Security Operations Center (SOC) metrics: mean time to detect (MTTD) reduced from 8-24 hours to 10-30 minutes, mean time to respond (MTTR) reduced from 24-72 hours to 15-60 minutes, and alert volume reduced from over 100,000 to 2,000-5,000 alerts per day [4], [17], [19]. The framework's performance on Industrial Control System (ICS) data is particularly encouraging, achieving 97.2% accuracy, addressing a critical gap in critical infrastructure protection [26], [35]. This work contributes a practical, deployable solution for modernizing cybersecurity operations in resource-constrained environments.